A controller must obtain the consumer's consent before processing sensitive data, and must process a known child's sensitive data in line with COPPA. Consent must be a clear, freely given, specific, informed and unambiguous affirmative act; accepting broad terms of use, hovering, muting, pausing or closing content, and agreement obtained through dark patterns do not count.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.